feat(nvca): configure worker-init transport TLS trust - #718
Open
mikeyrcamp wants to merge 9 commits into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change adds shared trust-bundle handling, Helm transport TLS configuration, operator ConfigMap reconciliation, configurable worker certificate paths, and worker-init image packaging. It also removes ChangesWorkload transport TLS
Estimated code review effort: 4 (Complex) | ~60 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant OperatorConfig as nvca-operator-config
participant Reconciler as NVCA reconciler
participant WorkerPod as LLM worker Pod
participant WorkerInit as worker-init
OperatorConfig->>Reconciler: Provide transportTLS configuration
Reconciler->>WorkerPod: Inject TLS volumes and installer init container
WorkerPod->>WorkerInit: Run nvcf-trust-bundle-install
WorkerInit-->>WorkerPod: Write merged certificate bundle
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
This was referenced Aug 6, 2026
kristinapathak
approved these changes
Aug 6, 2026
Max-NV
approved these changes
Aug 6, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (5)
src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go (2)
339-342: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd a negative case for
configMapUpdateForcesNVCAReconcile.The test asserts only the true cases. Add an assertion that an unrelated ConfigMap name returns false, so the
defaultbranch stays covered.Proposed fix
assert.True(t, configMapUpdateForcesNVCAReconcile(nvcfBackendChartDefaultsConfigMapName)) + assert.False(t, configMapUpdateForcesNVCAReconcile("unrelated-configmap")) + assert.False(t, configMapUpdateForcesNVCAReconcile(cleanup.ShutdownSentinelConfigMapName))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go` around lines 339 - 342, Extend TestConfigMapChangesForceNVCAReconcile with a negative assertion using an unrelated ConfigMap name, and verify configMapUpdateForcesNVCAReconcile returns false so its default branch is covered.
45-46: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse the package constant for the ConfigMap name.
Lines 262 and 291 use
nvcaOperatorConfigMapName. Line 46 hardcodes"nvca-operator-config". Use the constant so a rename keeps this test aligned with the production name.Proposed fix
- ObjectMeta: metav1.ObjectMeta{Name: "nvca-operator-config"}, + ObjectMeta: metav1.ObjectMeta{Name: nvcaOperatorConfigMapName},🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go` around lines 45 - 46, Replace the hardcoded ConfigMap name in the test’s ConfigMap creation with the existing nvcaOperatorConfigMapName constant, matching the usage at the other test locations and keeping the test aligned with the production name.src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go (2)
596-608: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSimplify
handleConfigMapAdd.Both branches after the type assertion return
nil, so theShutdownSentinelConfigMapNamecase changes nothing. The function now only validates the informer object type. Keep the type check and drop the sentinel branch, or add a short comment that Add events are ignored on purpose so a later reader does not re-add rollout logic. The receivercis also unused.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go` around lines 596 - 608, Update handleConfigMapAdd to retain only the ConfigMap type assertion and invalid-object error handling, removing the no-op ShutdownSentinelConfigMapName branch; optionally document that valid Add events are intentionally ignored. Since receiver c is unused, keep the implementation free of unnecessary receiver references.
640-659: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueThe two Helm-managed and self-managed cases are identical.
Both bodies compare data and call
c.dispatchReconcileClusterFunc(ctx). Merge them into onecase newCM.Name == nvcfBackendHelmManagedConfigMapName, newCM.Name == nvcfBackendSelfManagedConfigMapName:branch to remove the duplication.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go` around lines 640 - 659, Merge the duplicate branches in the ConfigMap update handler into a single case covering nvcfBackendHelmManagedConfigMapName and nvcfBackendSelfManagedConfigMapName. Preserve the existing diff comparison, conditional c.dispatchReconcileClusterFunc(ctx) call, logging, and return behavior.src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.go (1)
270-283: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueVerify the indentation contract of the appended key.
setTransportTrustInstalledBundleMountPathappends a raw line at four-space indentation to the YAML created bycreateTransportTrustSource. The key lands underworkload.transportTLSonly while the base document keeps its current nesting.decodeNVCAOperatorConfigusesKnownFields(true), so a future indentation change in the base fixture makes these tests fail with a confusing unknown-field error instead of a mount-path assertion failure. Consider building the document from one shared template that takes the mount path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.go` around lines 270 - 283, Update setTransportTrustInstalledBundleMountPath and the createTransportTrustSource fixture setup to use one shared YAML template that accepts the mount path, rather than appending a raw indented line. Preserve the existing workload.transportTLS nesting and ensure decodeNVCAOperatorConfig continues validating the generated document with KnownFields(true).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go`:
- Around line 629-659: Update the ConfigMap update handling in the switch cases
for configMapUpdateForcesNVCAReconcile, nvcfBackendHelmManagedConfigMapName, and
nvcfBackendSelfManagedConfigMapName so success logs only report a sync or
dispatched reconcile when diff != "". For unchanged data, log that the update
was ignored or omit the success message, applying the same behavior consistently
to all three cases.
- Around line 584-594: Update the ConfigMap informer callback that invokes
syncCurrentBackendForConfigMapChange to capture its returned error and log it
once with the callback’s logger. Preserve the existing fatal-error handling and
return behavior in syncCurrentBackendForConfigMapChange, avoiding duplicate
logging there.
In
`@src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.go`:
- Around line 182-198: Update decodeNVCAOperatorConfig to treat io.EOF from the
first decoder.Decode as an empty configuration and return the zero-value
nvcaOperatorConfigDTO without error. Preserve existing errors for non-empty
invalid YAML and retain the single-document validation for additional documents.
In
`@src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.go`:
- Around line 1423-1443: Build the desired agent ConfigMap once per sync,
including the trust Secret data resolved by getAgentConfigToMerge, then pass
that same result to newAgentConfigChangedCheck and setupAgentConfigConfigMap.
Remove their independent calls that reread the operator ConfigMap and Secret,
while preserving existing change detection and write behavior.
---
Nitpick comments:
In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go`:
- Around line 596-608: Update handleConfigMapAdd to retain only the ConfigMap
type assertion and invalid-object error handling, removing the no-op
ShutdownSentinelConfigMapName branch; optionally document that valid Add events
are intentionally ignored. Since receiver c is unused, keep the implementation
free of unnecessary receiver references.
- Around line 640-659: Merge the duplicate branches in the ConfigMap update
handler into a single case covering nvcfBackendHelmManagedConfigMapName and
nvcfBackendSelfManagedConfigMapName. Preserve the existing diff comparison,
conditional c.dispatchReconcileClusterFunc(ctx) call, logging, and return
behavior.
In
`@src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.go`:
- Around line 270-283: Update setTransportTrustInstalledBundleMountPath and the
createTransportTrustSource fixture setup to use one shared YAML template that
accepts the mount path, rather than appending a raw indented line. Preserve the
existing workload.transportTLS nesting and ensure decodeNVCAOperatorConfig
continues validating the generated document with KnownFields(true).
In
`@src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go`:
- Around line 339-342: Extend TestConfigMapChangesForceNVCAReconcile with a
negative assertion using an unrelated ConfigMap name, and verify
configMapUpdateForcesNVCAReconcile returns false so its default branch is
covered.
- Around line 45-46: Replace the hardcoded ConfigMap name in the test’s
ConfigMap creation with the existing nvcaOperatorConfigMapName constant,
matching the usage at the other test locations and keeping the test aligned with
the production name.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 78f4bf77-b095-4a7e-95e5-3e44df3a278a
⛔ Files ignored due to path filters (5)
deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-8e61e521-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yamlis excluded by!**/testdata/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/trustbundle/BUILD.bazelis excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/trustbundle/trust_bundle.gois excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/types/nvca/config/types.gois excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/modules.txtis excluded by!**/vendor/**
📒 Files selected for processing (42)
deploy/helm/nvca-operator/nvca-operator/README.mddeploy/helm/nvca-operator/nvca-operator/templates/deployment.yamldeploy/helm/nvca-operator/nvca-operator/templates/operator-config-cm.yamldeploy/helm/nvca-operator/nvca-operator/templates/pre-delete-cleanup-job.yamldeploy/helm/nvca-operator/nvca-operator/values.schema.jsondeploy/helm/nvca-operator/nvca-operator/values.yamlrules/oci/private/go.bzlsrc/compute-plane-services/nvca/cmd/nvca/BUILD.bazelsrc/compute-plane-services/nvca/cmd/nvcf-trust-bundle-install/main_test.gosrc/compute-plane-services/nvca/deployments/nvca-operator/README.mdsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/operator-config-cm.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/pre-delete-cleanup-job.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/values.schema.jsonsrc/compute-plane-services/nvca/deployments/nvca-operator/values.yamlsrc/compute-plane-services/nvca/internal/miniservice/transport_tls_test.gosrc/compute-plane-services/nvca/internal/transporttls/BUILD.bazelsrc/compute-plane-services/nvca/internal/transporttls/transport_tls.gosrc/compute-plane-services/nvca/internal/transporttls/transport_tls_test.gosrc/compute-plane-services/nvca/internal/transporttls/trustbundle/BUILD.bazelsrc/compute-plane-services/nvca/internal/transporttls/trustbundle/trust_bundle_test.gosrc/compute-plane-services/nvca/pkg/nvca/transport_tls_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/BUILD.bazelsrc/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/rollout.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.gosrc/compute-plane-services/nvca/scripts/lint_helm.shsrc/compute-plane-services/worker-init/cmd/BUILD.bazelsrc/compute-plane-services/worker-init/cmd/image_contents_test.shsrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/BUILD.bazelsrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main.gosrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main_test.gosrc/libraries/go/lib/pkg/trustbundle/BUILD.bazelsrc/libraries/go/lib/pkg/trustbundle/trust_bundle.gosrc/libraries/go/lib/pkg/trustbundle/trust_bundle_test.gosrc/libraries/go/lib/pkg/types/nvca/config/config_test.gosrc/libraries/go/lib/pkg/types/nvca/config/transport_tls_installer_image_test.gosrc/libraries/go/lib/pkg/types/nvca/config/types.go
💤 Files with no reviewable changes (10)
- src/compute-plane-services/nvca/cmd/nvca/BUILD.bazel
- deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml
- src/compute-plane-services/nvca/deployments/nvca-operator/templates/pre-delete-cleanup-job.yaml
- src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml
- src/compute-plane-services/nvca/cmd/nvcf-trust-bundle-install/main_test.go
- src/compute-plane-services/nvca/internal/transporttls/trustbundle/BUILD.bazel
- deploy/helm/nvca-operator/nvca-operator/templates/pre-delete-cleanup-job.yaml
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.go
- src/libraries/go/lib/pkg/types/nvca/config/config_test.go
- src/compute-plane-services/nvca/internal/transporttls/trustbundle/trust_bundle_test.go
4 tasks
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go`:
- Around line 603-605: The ConfigMap Add handler currently suppresses all valid
Add events instead of only informer initial-list events. Gate the no-op on
informer sync state, and after synchronization route Add events through the
existing name-specific reconciliation path used by updates; add regression
coverage for post-sync delete-and-recreate behavior.
- Around line 1120-1125: Update the error handling around
newAgentConfigConfigMap and newAgentConfigChangedCheck in SyncNVCFBackend to
remove the local log calls and return context-rich wrapped errors using the
requested operation descriptions with %w, preserving immediate returns on
failure.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e2a6f557-5bf0-493e-8f00-bd3017760aa2
📒 Files selected for processing (8)
src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/rollout.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/rollout_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go
🚧 Files skipped from review as they are similar to previous changes (4)
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.go
mikeyrcamp
force-pushed
the
agent/transport-tls-worker-init-mainline
branch
from
August 7, 2026 01:03
f70e313 to
8caa360
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go`:
- Around line 608-611: Update handleConfigMapAdd’s invalid-object branch to
remove its local log and return a context-rich error identifying the ConfigMap
informer Add handler and validation failure, without including the full object.
Apply the same change to the corresponding branch around the second referenced
location so the informer caller remains the single error logger.
- Around line 613-619: Update handleConfigMapAdd and its handler registration to
use cache.ResourceEventHandlerDetailedFuncs, distinguishing initial-list adds
from real ConfigMap add events. Defer or replay real adds when the ConfigMap
handler is synced but informersSynced is false, while continuing to ignore
initial-list adds until all required caches are ready. Add a regression test
covering this startup ordering and stale-backend prevention.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6a49b6cb-bc9c-4d56-9a49-2d352192f3c4
📒 Files selected for processing (2)
src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
- src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@deploy/helm/nvca-operator/nvca-operator/templates/operator-config-cm.yaml`:
- Around line 36-38: The Helm conditional around installedBundleMountPath
removes the newline after fingerprint, producing invalid YAML when the path is
set. In both
deploy/helm/nvca-operator/nvca-operator/templates/operator-config-cm.yaml lines
36-38 and
src/compute-plane-services/nvca/deployments/nvca-operator/templates/operator-config-cm.yaml
lines 36-38, remove the left-trim markers from the conditional actions so
fingerprint and installedBundleMountPath remain on separate lines.
In
`@src/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main.go`:
- Line 27: Update the go-lib dependency version in worker-init/go.mod to a
release that exports pkg/trustbundle, then regenerate worker-init/go.sum so its
checksums match the new module version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4bea2a13-60d4-4d5f-8c8c-942125777284
⛔ Files ignored due to path filters (5)
deploy/stacks/nvcf-compute-plane/testdata/golden/local/02-nvca.yaml-8e61e521-nvca-operator/helm-nvca-operator/templates/self-managed-nvcfbackend-cm.yamlis excluded by!**/testdata/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/trustbundle/BUILD.bazelis excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/trustbundle/trust_bundle.gois excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/github.com/NVIDIA/nvcf/src/libraries/go/lib/pkg/types/nvca/config/types.gois excluded by!**/vendor/**src/compute-plane-services/nvca/vendor/modules.txtis excluded by!**/vendor/**
📒 Files selected for processing (43)
deploy/helm/nvca-operator/nvca-operator/README.mddeploy/helm/nvca-operator/nvca-operator/templates/deployment.yamldeploy/helm/nvca-operator/nvca-operator/templates/operator-config-cm.yamldeploy/helm/nvca-operator/nvca-operator/templates/pre-delete-cleanup-job.yamldeploy/helm/nvca-operator/nvca-operator/values.schema.jsondeploy/helm/nvca-operator/nvca-operator/values.yamlrules/oci/private/go.bzlsrc/compute-plane-services/nvca/cmd/nvca/BUILD.bazelsrc/compute-plane-services/nvca/cmd/nvcf-trust-bundle-install/main_test.gosrc/compute-plane-services/nvca/deployments/nvca-operator/README.mdsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/operator-config-cm.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/templates/pre-delete-cleanup-job.yamlsrc/compute-plane-services/nvca/deployments/nvca-operator/values.schema.jsonsrc/compute-plane-services/nvca/deployments/nvca-operator/values.yamlsrc/compute-plane-services/nvca/internal/miniservice/transport_tls_test.gosrc/compute-plane-services/nvca/internal/transporttls/BUILD.bazelsrc/compute-plane-services/nvca/internal/transporttls/transport_tls.gosrc/compute-plane-services/nvca/internal/transporttls/transport_tls_test.gosrc/compute-plane-services/nvca/internal/transporttls/trustbundle/BUILD.bazelsrc/compute-plane-services/nvca/internal/transporttls/trustbundle/trust_bundle_test.gosrc/compute-plane-services/nvca/pkg/nvca/transport_tls_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/BUILD.bazelsrc/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/rollout.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/rollout_test.gosrc/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.gosrc/compute-plane-services/nvca/scripts/lint_helm.shsrc/compute-plane-services/worker-init/cmd/BUILD.bazelsrc/compute-plane-services/worker-init/cmd/image_contents_test.shsrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/BUILD.bazelsrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main.gosrc/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main_test.gosrc/libraries/go/lib/pkg/trustbundle/BUILD.bazelsrc/libraries/go/lib/pkg/trustbundle/trust_bundle.gosrc/libraries/go/lib/pkg/trustbundle/trust_bundle_test.gosrc/libraries/go/lib/pkg/types/nvca/config/config_test.gosrc/libraries/go/lib/pkg/types/nvca/config/transport_tls_installer_image_test.gosrc/libraries/go/lib/pkg/types/nvca/config/types.go
💤 Files with no reviewable changes (9)
- src/compute-plane-services/nvca/deployments/nvca-operator/templates/deployment.yaml
- deploy/helm/nvca-operator/nvca-operator/templates/deployment.yaml
- src/compute-plane-services/nvca/internal/transporttls/trustbundle/BUILD.bazel
- src/compute-plane-services/nvca/cmd/nvcf-trust-bundle-install/main_test.go
- src/compute-plane-services/nvca/deployments/nvca-operator/templates/pre-delete-cleanup-job.yaml
- deploy/helm/nvca-operator/nvca-operator/templates/pre-delete-cleanup-job.yaml
- src/compute-plane-services/nvca/internal/transporttls/trustbundle/trust_bundle_test.go
- src/compute-plane-services/nvca/cmd/nvca/BUILD.bazel
- src/libraries/go/lib/pkg/types/nvca/config/config_test.go
🚧 Files skipped from review as they are similar to previous changes (30)
- src/compute-plane-services/nvca/deployments/nvca-operator/values.yaml
- src/compute-plane-services/nvca/scripts/lint_helm.sh
- src/compute-plane-services/nvca/deployments/nvca-operator/README.md
- src/libraries/go/lib/pkg/types/nvca/config/transport_tls_installer_image_test.go
- src/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/BUILD.bazel
- src/compute-plane-services/nvca/pkg/operator/reconcile/BUILD.bazel
- src/compute-plane-services/worker-init/cmd/image_contents_test.sh
- deploy/helm/nvca-operator/nvca-operator/README.md
- src/compute-plane-services/worker-init/cmd/BUILD.bazel
- rules/oci/private/go.bzl
- src/compute-plane-services/nvca/pkg/operator/reconcile/rollout_test.go
- src/libraries/go/lib/pkg/trustbundle/BUILD.bazel
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper.go
- src/compute-plane-services/nvca/pkg/nvca/transport_tls_test.go
- deploy/helm/nvca-operator/nvca-operator/values.yaml
- src/compute-plane-services/nvca/internal/transporttls/BUILD.bazel
- src/compute-plane-services/nvca/internal/transporttls/transport_tls.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile.go
- src/libraries/go/lib/pkg/trustbundle/trust_bundle.go
- src/compute-plane-services/nvca/deployments/nvca-operator/values.schema.json
- src/compute-plane-services/nvca/internal/miniservice/transport_tls_test.go
- deploy/helm/nvca-operator/nvca-operator/values.schema.json
- src/compute-plane-services/nvca/pkg/operator/reconcile/nvca_config_mapper_test.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/rollout.go
- src/libraries/go/lib/pkg/types/nvca/config/types.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/transport_tls_config_test.go
- src/compute-plane-services/nvca/internal/transporttls/transport_tls_test.go
- src/compute-plane-services/nvca/pkg/operator/reconcile/backendk8scache.go
- src/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install/main_test.go
- src/libraries/go/lib/pkg/trustbundle/trust_bundle_test.go
mikeyrcamp
enabled auto-merge
August 7, 2026 01:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
main: feat(nvca): configure Secret-backed workload transport trust #655 (via feat(nvca): configure Secret-backed workload transport trust #672), feat(nvca): configure transport TLS mount path #708, and fix(nvca): use worker-init transport TLS installer #715. fix(self-managed): configure LLM router worker address #679's equivalent, fix(self-managed): configure LLM router worker address #678, is already inmain.workload.transportTLS.installedBundleMountPathwith validation for absolute, canonical, non-reserved paths and conflicting LLM-worker mounts.nvcf-trust-bundle-installin the standard worker-init image at/usr/bin/nvcf-trust-bundle-install, while preserving/worker-initas its primary entrypoint.imagePullPolicyfrom the rendered regularinitcontainer. A missing or image-lessinitcontainer terminally fails injection.TransportTLSConfig.InstallerImagefield and its fallback from the injection path; the regular worker-init container is the sole installer-image source./tiniwrapper is not present in the Bazel-built operator image.Rollout prerequisite
Publish worker-init with the installer first, then update applicable
INIT_CONTAINERmetadata/default/override references, and only then enable the NVCA injection change. This prevents an injected installer from selecting an older worker-init image without the executable.Supersedes
Fixes #713
Validation
bazel test //src/compute-plane-services/worker-init/cmd/nvcf-trust-bundle-install:nvcf-trust-bundle-install_test //src/compute-plane-services/worker-init/cmd:image_contents_testbash src/compute-plane-services/nvca/scripts/lint_helm.sh, including both chart copies and direct-entrypoint assertions.Dev2 live validation
Using temporary, non-release images, the worker-init image was pre-pulled to all six dev2 nodes and NVCA was configured to use it via a temporary
INIT_CONTAINERoverride. Recreating an LLM workload verified:initand injectednvcf-trust-bundle-installcontainers used the same worker-init image digest andIfNotPresentpolicy.STARGATE_TLS_CERT_PATH=/nvcf/transport-tls/ca-certificates.crt.The only worker restart was an initial inference-upstream readiness race; the subsequent worker instance connected successfully.
Summary by CodeRabbit